/build/static/layout/Breadcrumb_cap_w.png

Create Notification or Report to see any new software installed on my network

We have to give some privileged users admin rights to their machine and sometimes these get abused and we end up with software installed that shouldn't be. Is there away in the k1000 to create a notification or report that will tell me when a software has been installed?

0 Comments   [ + ] Show comments

Answers (1)

Answer Summary:
http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000
Posted by: jaredv 12 years ago
Fourth Degree Green Belt
1
You can create a scheduled report for software changes which are recorded in the 'Asset History'. It is not perfect, as it records many updates, as well as software that was installed via KACE itself, but if you can weed that stuff out, you will find what you need.

See this article:

http://www.itninja.com/blog/view/how-to-get-an-alert-in-case-of-inventory-changes-on-the-kace-k1000

Here is the SQL for the software changes report (You'd want to change the time interval to be however often you run the report, so if you run it once a day, I would suggest changing '60 DAY' to '24 HOUR'):

select ASSET_HISTORY.TIME, ASSET.NAME, ASSET_HISTORY.DESCRIPTION
from ASSET
left join ASSET_TYPE on ASSET.ASSET_TYPE_ID = ASSET_TYPE.ID
left join ASSET_HISTORY on ASSET.ID = ASSET_HISTORY.ASSET_ID
where (ASSET_TYPE.ID = 5
and NOW() < DATE_ADD(ASSET_HISTORY.TIME, INTERVAL 60 DAY)
and ASSET_HISTORY.DESCRIPTION not like '%KB%'
and ASSET_HISTORY.DESCRIPTION not like '%reboot%'
and ASSET_HISTORY.DESCRIPTION not like '%mac%'
and ASSET_HISTORY.DESCRIPTION not like '%user%'
and ASSET_HISTORY.DESCRIPTION not like '%ip changed%'
and ASSET_HISTORY.DESCRIPTION not like '%video controller%'
and ASSET_HISTORY.DESCRIPTION not like '%domain changed%'
and ASSET_HISTORY.DESCRIPTION not like '%ram total changed%'
and ASSET_HISTORY.DESCRIPTION not like '%registry max size%'
and ASSET_HISTORY.DESCRIPTION not like '%name%')
and (ASSET_HISTORY.DESCRIPTION like 'Found%'
or ASSET_HISTORY.DESCRIPTION like '%remove%'
or ASSET_HISTORY.DESCRIPTION like '%change%')
order by TIME DESC

Comments:
  • Perfect just what I was after works great.
    Cheers - The Pope 12 years ago
  • Is there an updated version for this? I tried copy pasting in SQL but got a bunch of errors. - sam240 7 years ago
    • Something like this might be useful:

      SELECT ID, CREATED, DISPLAY_NAME, PUBLISHER, DISPLAY_VERSION FROM ORG1.SOFTWARE
      where
      NOW() < DATE_ADD(SOFTWARE.CREATED, INTERVAL 30 DAY)
      AND IS_PATCH=0
      AND IS_MANUAL=0 - cblake 6 years ago

Don't be a Stranger!

Sign up today to participate, stay informed, earn points and establish a reputation for yourself!

Sign up! or login

Share

 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ